Skip to content
Book a call

Service · ISO/IEC 42001

ISO/IEC 42001 readiness for UK organisations

Know how far you are from an AI management system that stands up to audit, and what to fix first, before you book a certification body.

Last reviewed: .

Comonad prepares UK organisations for ISO/IEC 42001. The certificate comes from a certification body. In the UK, UKAS accredits certification bodies for this standard.

Book an introductory call
  • Risk and compliance leads
  • Internal audit
  • CTOs and product leads

What ISO/IEC 42001 is

ISO/IEC 42001:2023 (opens in new tab) is the international management-system standard for AI, published in December 2023. It sets requirements for establishing, implementing, maintaining and continually improving an AI management system: the policies, objectives, roles, risk processes and controls through which an organisation governs the AI it develops, provides or uses. It applies to organisations of any size and sector.

What we do

Readiness and a gap assessment. Certification stays with a certification body.

  • Gap assessment. Your current policies, roles, risk and impact processes and controls, set against the standard's clauses and Annex A controls, with each gap listed, owned and ranked.
  • AI management system design. Scope, AI policy, roles and responsibilities, AI risk assessment, AI system impact assessment and the Statement of Applicability, built on what you already run.
  • Evidence readiness. The records that show each process and control operating, and an internal audit and management review cycle your team can run.
  • Shared controls. Where you also have ISO/IEC 27001 or EU AI Act duties, each control is written once and cited from both.

ISO/IEC 42001 and the EU AI Act

The EU AI Act is law. ISO/IEC 42001 is a voluntary standard for the organisation's management system. ISO/IEC 42001 is not a harmonised standard under Article 40 of the Act, so certification to it does not by itself show that a system meets the Act's obligations. CEN-CENELEC published EN 18286:2026 in July 2026 as the quality management standard written for Article 17. Where both apply, we map the same controls to each. See EU AI Act compliance.

What you keep

  • Gap report

    Each clause and Annex A control: met, partly met or missing, with an owner.

  • AIMS documents

    Scope, AI policy, roles, risk and impact assessment method, Statement of Applicability.

  • Remediation plan

    What to fix, in what order, and how you will show it is done.

  • Evidence map

    Where each record lives and who produces it.

How an engagement runs

What we do not do

  • We do not certify, and we are not a certification body. Certification is carried out by certification bodies; in the UK, UKAS accredits them.
  • We do not choose your certification body for you or take part in your certification audit as an assessor.

Who it is for

  • Risk and compliance leads who want to know the gap before they book a certification body.
  • Teams that already run ISO/IEC 27001 and want one control set rather than a second project.
  • CTOs and product leads who own the AI systems the management system has to cover.

Our founder spent almost seven years as co-founder and CTO of Cloud KB, building software for the UK energy market. Read his profile.

Alex Vakhitov, founder of Comonad Limited

Alex Vakhitov

Founder, Comonad · AI and software architect, London

Alex Vakhitov founded Comonad in 2024. An AI and software architect, he was co-founder and CTO of Cloud KB, UK energy-market software, from August 2015 to March 2022.

Read Alex Vakhitov's profile

Questions about ISO/IEC 42001 readiness

Can you get us certified?

We get you ready. The certificate comes from a certification body after its own audit; in the UK, look for one accredited by UKAS for ISO/IEC 42001.

How long does readiness take?

It depends on your scope and on what you already run. The gap assessment gives you a dated plan; we agree its length in the written scope.

We already have ISO/IEC 27001. Does that help?

Usually a great deal. Access control, logging, supplier management and the audit cycle carry over. ISO/IEC 42001 adds what 27001 does not cover: AI risk and impact assessment, data for AI systems, and how each system is developed, evaluated and used.

Is there a UKAS-accredited route for ISO/IEC 42001?

Yes. UKAS granted its first accreditation for ISO/IEC 42001 certification in January 2026, so UK organisations can choose a UKAS-accredited certification body.

Sources

Related

Discuss ISO/IEC 42001

Tell us what you already run, and whether a gap assessment is the first step.

Discuss ISO/IEC 42001